Add the CVE policy

Add the place for security-related policies and the CVE policy describing the
way of handling security vulnerabilities.

Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com>